Isochronous Event Handling Vulnerability in Linux Kernel by Linux Foundation

CVE-2025-37882

Summary

In the Linux kernel, a vulnerability has been identified that affects isochronous event handling on xHCI (eXtensible Host Controller Interface) devices. This issue arises from potentially mishandling events when the TRB (Transfer Request Block) pointer is either incorrectly set or NULL during processing. A race condition can develop under certain load conditions or due to modified interrupt moderation, leading to skipped transfer descriptors (TDs) after a Missed Service Error (MSE). This behavior may result in premature completion of TDs, causing data loss or a use-after-free (UAF) condition in the xHC. It is essential to ensure that TDs are only completed on appropriate xrun events and maintain proper warnings if queued TDs do not correlate with the current event's TRB pointer.

References